Security+ Performance Based Questions: Working the Part Most People Dread

Ask around about Security+ and the same three letters keep coming up. Performance based questions have a reputation for being the hard part, and that reputation is only half earned. The material behind them is the same material the rest of the exam draws on. What they take from you is time, and time is what a lot of people underestimate on a first attempt. Handle the clock well and PBQs turn into one of the more forgiving parts of the exam.

What a PBQ actually asks you to do

A PBQ drops you into a small simulated environment and asks you to carry out a task. Common shapes include dragging controls onto a network diagram, filling in firewall or access control rules, matching an attack to the evidence in a log excerpt, and reading tool output to say what went wrong. The answer options are gone, so you cannot work backwards from a list, and recognition on its own will not carry you.

Network+ uses performance based questions too, and the pacing advice below transfers, though its tasks lean toward configuration and topology more than security controls. Check the objectives for the exam code you are booked for.

Why they usually come first

PBQs tend to sit at the front of the exam. That placement catches people out, because the hardest looking questions arrive while you are still settling in, and a candidate who decides to finish the first one properly can burn twenty minutes before banking a single easy point. CompTIA does not publish how many PBQs a given form carries, and it can vary, so plan for a handful and let the count be whatever it is. Exam deliveries generally let you flag a question and come back to it, but confirm that on the tutorial screen at the start of your own exam.

A time strategy that holds up

• ›Check the tutorial screen first. If your exam lets you flag and return, skim every PBQ, answer none of them, and flag them all. Two minutes spent seeing what is coming stops the panic that makes people rush the multiple choice later. If you cannot return, work them in order and cap your time on each one.
• ›Go do the multiple choice. It is faster per point, and banking those questions gives you a real sense of how much time you can afford when you come back.
• ›Return to the PBQs with what is left and spend it deliberately. Start with the one you understood best on the skim, because the one you can finish cleanly is where your remaining minutes are worth most.
• ›Put something in every field before you leave a PBQ. Candidates and instructors widely report partial credit on these, and CompTIA does not publish the scoring detail, so treat a partial answer as better than a blank one without treating it as a rule.
• ›Watch for the PBQ that is quietly simple. Some are a two minute drag and drop dressed up in an intimidating interface, and people skip them because of how they look.

Study so a PBQ is just a question with more clicking

The way to get comfortable is to practice explaining your reasoning out loud. When you work an ordinary scenario question, say why the keyed answer wins and why each of the others loses. That habit is most of what a PBQ measures, because a PBQ hands you a situation and asks you to produce the reasoning with no list to check yourself against. If you can only recognize the right answer when you see it, the simulation will find that out.

Then get hands on, because these tasks are ones you can rehearse directly. Build an access control list and read it back to yourself line by line. Run a scan and interpret the raw output before you look anything up. Take a log excerpt and walk it to a named attack. Free lab environments and a spare virtual machine will teach you more in an evening than another pass through your notes, and they build the thing multiple choice never asks for, which is producing a working configuration under your own steam.

Techunique is an independent practice tool and is not affiliated with CompTIA. Exam formats and objectives change between versions, so check the current objectives and the candidate information for the exam code you are actually booked for. Do enough reps and the simulation stops being the part you dread and starts being the part you get to show off on.